iPassword 8 - error signing in when using proxy

Hello everyone, 👋

I received a similar question on Twitter and went digging for help in our internal Slack to find the answer. @ag_Christian was kind enough to explain the details to me so I thought I'd pay it forward here for others curious about the change. Including my future self when I forget the specifics. 🙂

1Password 7 used the WinHTTP networking APIs which rely on the TLS stack provided by the OS by default. In 1Password 8 we do all of our networking in Rust and use webpki to verify TLS certificates currently. We have some internal discussions going on for how to have the best of both worlds and will report back here when it becomes possible to use 1Password 8 in these environments.

I was a bit confused on how it was possible TLS traffic could be intercepted without failing validation. If you're in a similar boat, I found Christian's explanation helpful:

These TLS interception methods work by inserting a trusted CA into the system’s CA root store that is owned/controlled by the software/hardware doing the inspection. So when something connects to an HTTPS domain and sees the MiTM certificate, Windows’ sees that certificate was issued by a CA it knows about and was configured to trust.

I’ve always been fascinated by SSL introspection and as a user I’d prefer things to break. I totally understand this is likely beyond most people's control though, so it will be great to get this working again in 1Password 8. It also makes me happy that we use SRP to establish a separate encrypted session of our own so those SSL interceptors aren't gonna see much when looking at our traffic. 🙂

++dave;

ref: dev/core/core#7409

Also got the SSL interception issue w/v.8.4 (hate our McaFee SSL gateway :| )

Funny enough v.8.4.0 works behind SSL gateway from macOS

Same issue for my company.
I get why it was released this way, but you probably should at least mention it in the blog post somewhere, so people don't waste their time finding this thread.
Or some known issues page.

Nice to hear that you hate TLS interception, as we hate it. But you are presenting you'r software for enterprise-level, how it cold not work in enterprise networks? (as I understand, sniffing TSL, is a standard for enterprise)

I'm not sure if it can be called a "standard" but I agree it is quite popular in the enterprise. It's a limitation of the first release and we're working on getting it fixed up.

As for adding this to the blog post, I was already failing at cutting content from the post to get it under my (admittedly self-imposed) 5 minute read limit. I like the idea of a known issues page though. I had started drafting something similar for this forum but didn't get it over the finish line. I'll look at dusting that off this week.

Regarding 8.4 working behind an SSL gateway on macOS, that's surprising to hear, @Siimnet. It's the same Rust library underneath the covers so I'd expect both Windows and Mac to behave the same. Specifically, I'd expect them both to fail at the moment. Is it possible the SSL inspector has been configured to avoid Macs or something?

++dave;
1Password Founder

@dteare hm rethinking, maybe it's because Mac possible isn't controlled by our security dept. and thus not configured to go through the SSL GW...

That would explain it. Thanks for clearing that up.

++dave;

Thank you @dteare for the detailed explanation of what's happening here. I was excited to give the version 8 client a try today at work but immediately ran into this issue. (I should have done a quick read of the known issues.) I've rolled back to the version 7 client and that will work fine until the issue is resolved. Like so many others, my workplace implements https inspection. I do understand why some organizations feel compelled to do this type of inspection but I don't love the practice. Indeed, one of the endearing qualities/features of the 1Password security architecture is that the TLS layer, while nice to have where available (uncompromised), is not technically necessary for the security of the client/server communications. It is 1Password's incorporation of SRP that really makes 1Password special in the cloud-based password manager product space.

Thanks again for the update. Hopefully, the issue will be resolved soon-ish. I'm eager to try out the new Electron-ified UI for the Windows application.

Best,
GBR

Hello everyone, 👋

I wanted to give an update on the changes to make things work properly with TLS/SSL interception setups in enterprise networks. The code that enables this was just merged a few minutes ago and we published a new nightly release so y'all could give it a try and see if it works in your setup.

If you'd like to give this a try yourself please go to Settings > Advanced and change the release channel to NIGHTLY and update. You should see build #80500038 or higher in the Settings > About window. Please let us know how it turns out. 🤗

For full discourse, note that this is a nightly release so in general it's not tested nearly as much as our betas. You'll be using the same version as our team is using which can be a good thing but can also mean you get bugs we haven't found yet and will need to live with them until they get fixed (likely in the next nightly or two).

Cheers! 🍻

++dave;